Release LordOS 0.8.0-beta · lordbasex/LordOS

LordOS is a free GNU/Linux distribution based on Debian 13 ("trixie") with its own desktop environment. Debian provides the kernel, the drivers, Mesa, PipeWire, CUPS, BlueZ and every package in the archive, with Debian's security updates. On top of that LordOS ships its own graphical layer: a display server and Wayland compositor written in C that drives the screen and input straight from the Linux kernel, its own interface engine running React, a full desktop and 29 native apps. GTK, Qt and other Wayland apps (Chromium and Firefox are preinstalled) open as ordinary windows next to the native ones.

This is the first public release. It documents everything LordOS has today, not only what changed since the last internal build. It is a beta: most of it works and is tested in virtual machines, but some parts have not been tested on real hardware yet (see Known issues and limitations). The project paper, docs/PAPER.md, gives the big picture.

Highlights

Light enough for modest hardware. The whole system idles at 465–487 MB of RAM and 99 % idle CPU, the live system boots to the desktop in 16.3 s, and lord-server (the display server with the whole desktop) uses 32–36 MB (measured in the final ISO test, see docs/ISO.md).
A desktop of its own, built on Debian and Wayland. Its own display server and Wayland compositor in C, its own React interface engine, two themes, a Dock, search, a clipboard history, several displays with sharp HiDPI, and smooth window moving even without a GPU.
Private by design. Third-party apps run sandboxed (Landlock, seccomp, cgroup v2) behind a permission broker, with system-drawn prompts for the camera, microphone, files, screen and network. Passwords and other sensitive windows are black in screenshots, recordings and the remote desktop.
A visible, per-app firewall. Allow or block the network per app, by domain, address or network, enforced in the kernel with cgroup BPF, and see every app's connections on a world map in Monitor. Linux apps can also be denied the camera, microphone, USB, Bluetooth, screen, notifications and your files.
29 native apps. Files, Terminal, Text Editor, Notes, Mail, Calendar, Contacts, Reminders, Passwords, PDF Viewer, Photos, Player, Camera, Recorder, Screenshots, Monitor, Disks, Backups, Store and more, in English, Spanish and Portuguese, right to left included.
Install it your way. A live and installable ISO for 64-bit PCs (UEFI and BIOS), a Raspberry Pi 5 image, or one command on an existing Debian 13. Every release file is listed in an Ed25519-signed SHA256SUMS and comes with an SPDX SBOM.
Every language, every script. Full Unicode bidi, Arabic, Indic and about 80 more complex scripts shaped by our own engine, and Korean, Japanese and Chinese input methods.

Added

Desktop and display

Display server (lord-server): our own DRM/KMS modesetting with double buffering and page flips, our own evdev input, and a 2D rasterizer with antialiased rounded rectangles, shadows and blur. It drops root after opening the display and input.
GPU composition with Mesa (EGL, GBM, GLES2), linux-dmabuf, direct scanout for fullscreen apps and a hardware cursor plane; the CPU path stays as the fallback and as "safe mode" (docs/GPU.md).
Interface engine: QuickJS embedded in the server, a native node tree, a CSS subset, our own flexbox layout (with flexWrap), text ellipsis, per-side borders, logical (start/end) edges, scale and rotate transforms, damage tracking and cached shadows. React 19 runs on it through the stock react-reconciler. Painting got faster before the release: a full-screen paint went from 12.5 to 4.8 ms, and dragging across two displays from 11.3 to 2.5 ms per frame.
Wayland compositor: GTK, Qt and other Wayland apps open as LordOS windows with the theme's frame, in the Dock and the app launcher, with a shared clipboard (images too, surviving the source app), xdg-decoration, popups, app cursors, real fullscreen, wp_presentation, wp_viewporter, relative pointer and pointer constraints for games, and fractional scale (docs/WAYLAND.md).
Linux apps from the launcher: installed .desktop apps appear in the app launcher (by freedesktop category), the start menu and the Dock, each in its own cgroup scope; "Open With" in Files and default apps per file type.
Two themes, "Lord Default" (menu bar, magnifying Dock, Control Center) and "Classic" (taskbar and start menu), switchable live, in light and dark mode with accent colours.
Dock at the bottom, left or right, with size, magnification and auto-hide (docs/DOCK.md).
Search for apps, files, notes, Store packages, help articles and a calculator, and an advanced clipboard with history (❖V) that keeps passwords out (docs/SPOTLIGHT.md).
Moving and resizing windows: pointer motion coalesced to one per frame, moving and resizing done in C, resizing from all four sides and corners, and LordOS's own cursors (docs/WINDOWS.md).
Several displays and HiDPI: extend or mirror, each display at 100, 125, 150, 175 or 200 %, rasterized at the display's real resolution, so a 4K panel next to a 1080p one is sharp on both (docs/DISPLAYS.md).
Touchpads and touchscreens with our own multitouch driver: acceleration, tap to click, scrolling with inertia, pinch to zoom (Chromium's too) and three-finger swipes (docs/TRACKPAD.md).
Sessions (lord-sessiond): LordOS's own login screen, screen lock (❖L), fast user switching, parallel sessions and Settings → Users (docs/SESSIONS.md).
Remote desktop from a browser on the local network: open https://<machine IP>:5673 and sign in with a user of the machine. Nothing to install on the other computer. Off by default (docs/REMOTE.md).
Notifications for native and Linux apps (org.freedesktop.Notifications), with per-app settings, Do Not Disturb with a schedule, and menu-bar status items.

Apps

Files: tabs, four views, freedesktop Trash, Quick Preview, Get Info, background copy and move, drag and drop, colour tags, search, mounted disks, browsing inside archives, Extract Here and Compress (docs/FILES.md, docs/DOCUMENTS.md).
Terminal: our own xterm-256color emulator in C with tabs, split panes, profiles and colour schemes, inline images and Sixel, shell integration (bash, zsh, fish), triggers, Instant Replay, tmux -CC with native tabs, ligatures, colour emoji, and sessions that survive a server restart (docs/TERMINAL.md).
Text Editor: our own code editor with syntax highlighting, projects, go to file, find and replace and multiple cursors (docs/EDITOR.md).
Notes: markdown notes with a reading view and index, images, attachments and emoji, and sticky notes on the desktop; saved in ~/Notes (docs/NOTES.md).
Mail, Calendar, Contacts and Reminders: IMAP (with IDLE) and SMTP for any provider, conversations, a unified inbox and categories, HTML mail shown through our own sanitizer with remote images blocked until asked, tracking pixels dropped and deceptive links flagged; CalDAV calendars and reminders, CardDAV contacts, and meeting invitations answered from Mail. A 10,000-message folder syncs in about 2 s (docs/MAIL.md).
Passwords, which is also the system keyring: our own encrypted .lvault format (XChaCha20-Poly1305, Argon2id), unlock with a master password, a FIDO2 security key, a key file on a USB stick or a recovery key; 2FA codes, a generator, a security report, Wi-Fi QR codes, KDBX and CSV import, and the freedesktop Secret Service, so Chromium, Firefox and secret-tool keep their secrets there (docs/PASSWORDS.md).
Documents: a PDF Viewer (search, outline, annotations saved as a copy, forms, dark pages, printing), Quick Preview for PDFs, fonts and archives, Fonts and Emoji & Symbols (❖.) (docs/DOCUMENTS.md).
Printing and scanning: add driverless network printers, a system print dialog with preview, and a Scanner app over eSCL. LordOS speaks IPP to CUPS with its own client and finds devices over mDNS (docs/PRINTING.md).
Media: Photos (HEIC, AVIF, WebP, animated GIF, basic editing), Player (video with subtitles, picture in picture, a music library), Screenshots (screen, window or area, annotation, screen recording to MP4), Camera and Recorder. Decoding runs in a sandboxed helper; a 1080p video costs 13 % of a core windowed and 15 % fullscreen (docs/MEDIA.md).
Monitor: CPU, memory, network, disks and processes, each app's connections on a world map (country by IP from an offline database), the firewall's rule per app, and Cooling (docs/MONITOR.md).
System apps: Disks (SMART health, format, erase, and a bootable USB from an ISO verified with SHA-256), Backups (scheduled snapshots of your home folder, optional encryption, restore by date), Logs (our own systemd journal reader), Clock (world clock, alarms, timer, stopwatch) and Help (searchable articles and a welcome tour) (docs/SYSTEM.md).
Store: Debian packages by category with search, a plan of what will be installed, upgraded or removed before anything changes, updates (Debian's security updates included), local .deb files and native .lpk apps. Our own package engine verifies Debian's signed indexes and hands the last step to dpkg (docs/PACKAGES.md).
Native .lpk apps, installed without root, each running as its own isolated process (docs/NATIVE-APPS.md), and our own WebAssembly interpreter for them (26,290/26,290 assertions of the official test suite; docs/WASM.md).
Settings, Calculator, Characters, About and the Install LordOS assistant on the live ISO.
Chromium and Firefox ESR preinstalled as Linux apps, with the LordOS window frame.

Privacy and security

App sandbox of our own, without Flatpak, bubblewrap or firejail: Landlock, a seccomp-bpf allow list, no_new_privs, dropped capabilities and a cgroup v2 scope per app (docs/PRIVACY.md).
Each .lpk app as its own process (lord-server --app <id>), talking to the desktop only through a broker that checks every call; a malicious test app fails at everything at run time.
Per-app permissions with prompts drawn by the system (not the app), stored where the app can't write, managed in Settings → Privacy, and green/orange dots while the camera or microphone is in use. Revoking the camera or microphone stops it at once.
Powerbox file picker: an isolated app only gets the file the user picked, never the folder.
Protected windows: Passwords and other sensitive windows are black in screenshots, recordings, the remote desktop and thumbnails.
Package signing: .lpk apps signed with Ed25519 (our own SHA-256 and Ed25519 code, tested against RFC 8032 and NIST vectors), trust levels in the Store, a signed catalog with revocation, "Modified by you" detection, "Restore original" and "Share my version" (docs/SIGNING.md).
Sandboxed helpers: the only programs that link Poppler and libarchive (lord-doc), FFmpeg (lord-media), the mail parsers (lord-maild) and the vault crypto (lord-vault) run with no network, no sockets and no exec, and work only on the file descriptors they are given.
Secret clipboard: copied passwords stay out of the history and are cleared after 30 s.

Firewall

Per-app network rules enforced in the kernel by lord-netperm, a root service with cgroup BPF programs (connect, sendmsg, bind, socket creation) and its own BPF loader. Rules can allow or block all traffic, a domain and its subdomains, an address, a network, the LAN only, or incoming connections (docs/FIREWALL.md).
Settings → Privacy → Network rules by app: each app's default and its rules, in the order they win (the most specific rule wins), with when each last matched, and a sheet that checks what you type as you type it.
Monitor → Network: a per-app switch, allowed and denied counters, recent destinations, and "Allow / Block this domain" prefilled with the name the system resolver gave for the address.
Restrictions beyond the network: for LordOS apps, no camera, microphone, screen, USB, files, clipboard, Bluetooth or notifications, refused without a prompt and applied live. For Linux apps: no camera, no USB and no Bluetooth sockets (kernel device and LSM programs), no microphone (a PipeWire guard plus the ALSA capture nodes), no notifications, and "no access to your files" (its own user, mount and PID namespace plus Landlock, from the next launch).
No screen capture for Linux apps, by design: the compositor offers no capture protocol, there is no X server and no screen-cast portal, and /dev/fb* is denied.
Cheap: about 0.5 µs per UDP connect, no measurable cost on TCP connects or throughput, and nothing in the frame loop.

Network

LordOS's own networking on top of the kernel, without NetworkManager: rtnetlink, our own DHCP client, Wi-Fi through wpa_supplicant, and DNS (docs/NETWORK.md).
The network belongs to the system (lord-netd): it comes up at boot before anyone logs in, survives users logging in and out, and resumes its DHCP lease after a crash.
VPNs in Settings → Network: WireGuard (our own netlink and X25519 keys), OpenVPN, IPsec/IKEv2 (strongSwan's charon, driven by our own VICI client), PPTP, and two optional SSL VPN clients (one of them OpenConnect) that are enabled from Settings. Wi-Fi and VPN secrets are kept in the keyring.

Hardware: fans, displays, Bluetooth, power, sound

Fan control (lord-fand, from the first boot, before anyone logs in): System, Quiet, Balanced, Performance, Always on and Custom curves, a full-speed override, and Cooling pages in Settings and Monitor with the hardware drawn live, including the Raspberry Pi 5 fan header and the Argon ONE V5 case (docs/FANS.md).
Displays: modes from KMS with the monitor's name, a 15-second "Keep these display settings?" revert, settings saved per monitor, rotation, brightness, and Night Light on a schedule from sunset to sunrise (docs/SETTINGS.md).
Bluetooth through BlueZ with our own D-Bus client: discover, pair (system-drawn PIN and passkey prompts), connect and forget; headsets appear in Sound.
Energy: battery state and health, low-battery notices, power profiles, display off, lock and sleep timers, power button and lid actions.
Sound on PipeWire with our own client: outputs, inputs and per-app volume in the Control Center and Settings (docs/SOUND.md).
Date & Time (network time or manual) and Default Apps pages in Settings.

Raspberry Pi 5

ARM64 is an official platform; the Raspberry Pi 5 is the supported board (4, 8 or 16 GB), the only one we test (docs/RASPBERRY.md).
An image for Raspberry Pi Imager (lordos-<version>-rpi5-arm64.img.xz, about 500 MB): Debian 13 arm64, the same LordOS package as the PC, a partition that grows on first boot, and first-boot setup from lordos-user.txt on the boot partition (user, Wi-Fi, SSH and remote desktop switches).
A LordOS build of the Raspberry Pi kernel with Landlock (6.18.57-lordos-rpi-2712), pinned over the archive kernel, and tools/rpi/verify-board.sh to check a board after flashing.
Separate display and GPU (vc4 and v3d) and optional NEON drawing, bit-identical to the C code.

Install and boot

Live and installable ISO for 64-bit PCs, hybrid for USB sticks, UEFI and BIOS: English by default, Spanish and Portuguese entries, safe mode (CPU only) and copy to RAM. Final test image: 964 MB, a 2.5 GB system, built in 14.5 minutes (docs/ISO.md).
Install LordOS assistant: language, keyboard, disk (with a strong confirmation), user and summary; it installs in about 2 minutes and boots by UEFI and BIOS. Every value is validated again on the root side and the password never appears in a command line.
One command on Debian 13 (amd64 or arm64): curl -fsSL https://lordos.org/install.sh | sh checks the release signature and SHA-256, installs with apt, sets up the login screen and asks before switching the display manager; --uninstall undoes it (docs/INSTALL-DEBIAN.md).
Servers and VPS without a screen: curl -fsSL https://lordos.org/install.sh | sh -s -- --remote-desktop (optionally --remote-port N, 1024–65535, default 5673) also turns on the remote desktop, in the same configuration file Settings → Sharing uses, after a confirmation that warns the port accepts logins from the network. Without a display manager the login screen runs headless, so the desktop is reached at https://<server IP>:5673 from a browser, on amd64 and arm64. --uninstall removes the configuration and closes the port (docs/INSTALL-DEBIAN.md, "Servers and VPS").
Boot splash and boot menu: a LordOS GRUB theme and a Plymouth splash (the crown with a progress bar) that hands off to the login screen without a black frame or console text.
The version and release channel are built into the system and shown in About and Settings → General.

Languages

English (default), Spanish and Portuguese across the interface, with live switching and more languages installable as packs, without touching code (docs/LANGUAGES.md).
System-wide language and region: Debian's own messages, dates and numbers follow it; every XKB keyboard layout, up to four at once.
Complex scripts with our own engine: full Unicode bidi (91,707/91,707 conformance cases), Arabic, Indic, Thai, Khmer, Myanmar and the Universal Shaping Engine (409/409 test sentences identical to HarfBuzz), and a mirrored interface for right-to-left languages.
Input methods for Korean, Japanese and Chinese (pinyin), in text fields and the Terminal.
Translatable error codes, so errors read the same in every language.

Website and docs

lordos.org in English, Spanish and Portuguese: features, apps, gallery, FAQ, the project paper (with PDFs), the release key and install.sh, and complete legal and trust pages (security policy, code signing, licences, privacy, support lifecycle, standards and more).
A hero slideshow of 39 real, checked screenshots inside the laptop on the home page, in story order, with play/pause, previous/next, a counter and captions; it pauses on hover, focus and hidden tabs and respects reduced motion. The spec facts sit in a stats row below it.
Site navigation: a hamburger menu with a CSS-only drawer on phones (focus trap, Esc), a back-to-top button, a one-slot language dropdown, a dark-mode switch and a centred footer bar; the Debian card covers PCs and servers (amd64 and arm64, with the --remote-desktop hint) and the FAQ has an entry on servers and VPS. The site runs under a strict CSP (no inline styles or scripts).
Documentation for every part of the system, indexed in docs/README.md, with the project paper and screenshots from real test runs.
Repository policies: SECURITY.md, CONTRIBUTING.md, CODE_OF_CONDUCT.md, issue forms and docs/COMPLIANCE.md.

Brand

New LordOS brand: a vector crown logo, app icon and lockups, a Plus Jakarta Sans wordmark, and a brand kit (docs/LORDOS-BRAND.md).
Lumo, the LordOS guardian: a vector mascot used in empty states, Store updates, Monitor, Help, the installer and About.
Our own names and assets only: a brand check (tools/brand-check.mjs) keeps third-party product names out of the interface and docs.

Changed

English is the default language of the interface, the ISO and the installed system; code, comments and documentation are in English (interface text stays translated in assets/locales/).
React 19 (from React 18) for the interface engine.
Notes keeps its notes in ~/Notes (it was ~/Notas) and moves the old folder there on first run; the SDK's user folders default to the English names when user-dirs.dirs is missing.
Only the Raspberry Pi 5 is supported among Raspberry Pi boards; the website and docs no longer mention other models.
Visual polish pass of every native app following the LordOS design guide (docs/DESIGN.md, before and after screenshots in docs/polish/).
The boot menu drops GRUB's countdown bar and uses a tighter selection band.
The README uses the same copy as lordos.org, with measured figures instead of estimates.
Linux apps restricted from the microphone, camera, USB or Bluetooth start in their own view, without the session bus or the user manager (no notifications or portals for them), so they can't escape their scope. A restriction set while such an app runs applies fully only after the app is restarted; Settings says so (docs/FIREWALL.md).
pipewire-pulse doesn't load modules (/etc/pipewire/pipewire-pulse.conf.d/lordos-no-modules.conf): a module loaded by a restricted app would run outside its restrictions. Apps that load PulseAudio modules at run time (pactl load-module) get an error.
kernel.yama.ptrace_scope = 1 (/usr/lib/sysctl.d/50-lordos-ptrace.conf): a process can only trace its own descendants. Debuggers still work on programs they start; attaching to a running process (gdb -p, strace -p) needs sudo.
The copyright holder is "iPERFEX and the LordOS contributors" (MIT licence unchanged).

Fixed

The network did not come up on the live ISO when every session became headless, and two sessions could start DHCP on the same interface.
"Restart" after installing needed two clicks and could leave a black screen (shared mounts of the installer's chroot unmounted the live medium).
The English live session started with the Latin American keyboard; the keyboard now follows the boot entry's language.
GTK 3 apps drew the light default theme instead of the LordOS look (missing GSettings schemas).
The package's copyright file said the licence was undefined; it now carries the MIT text and lists the bundled fonts.
The Dock's hit box, audio for newly created users, upgrade-safe helpers, and the login screen now preselects the last user.
lord-server survives SIGPIPE when a client hangs up mid-write.
Restarting lordos.service left the old login screen running (and, after an upgrade, its old binary); lord-sessiond now stops the login screen's processes when it stops and any leftover when it starts (docs/SESSIONS.md).
A crash when a Dock window had no icon.
The firewall attributed "last matched" to the wrong rule after a save.
Short connections (such as curl) were missing from Monitor → Network; recent destinations are now listed from the firewall's notices.
Settings icons drawn blank, GRUB menu borders shown as "?", PipeWire without real-time priority, and ping without root on the live system.

Security

Hardening and findings fixed before this first release. The full review is in docs/SECURITY-REVIEW-0.8.0.md; report vulnerabilities as described in SECURITY.md.

Firewall restrictions were stored but not enforced for the camera, microphone, screen, USB, files, clipboard, Bluetooth and notifications. They are now enforced where each resource is handed out, beat any permission grant, and apply live (58 broker checks in tests/broker_restrict_test.c).
Escape through systemd-run --user: a Linux app could leave its scope for the user manager. The programs now also cover each user's user@<uid>.service, with no exemption for the user's own audio services, which the app could otherwise move into.
App scopes are owned by root, so a Linux app can no longer move itself to another cgroup.
"No access to your files" for Linux apps now runs the app in its own user, mount and PID namespace: Landlock alone did not cover unix-socket connect() in kernel 6.12, so an app could have asked the session bus to start something outside the restriction. Its writable folders come only from its desktop id, never from fields a malicious .desktop file controls.
PipeWire guard identity comes from the socket's kernel credentials; a forged application.process.id or an unresolvable client is treated as restricted (fail closed).
Microphone restriction also covers recording straight from the sound card (ALSA capture nodes), not only through PipeWire.
Notifications: only the bus itself can say who sent a notification; forged, failed or late answers drop it.
Permission prompts and file pickers use ids generated by the server, so an app can't answer another app's prompt.
Mail: HTML goes through our own sanitizer into native views (no web engine), remote content is blocked until asked, and the parsers run in a sandboxed helper with no network of its own; 31,000+ checks including mutation fuzzing.
Installer: every value is validated on the root side, the password travels over a socketpair (never argv), is hashed with yescrypt and wiped from memory.
Signed releases: SHA256SUMS is signed with the LordOS Ed25519 release key, and the Debian installer refuses to install when the signature is missing or invalid.
Remote desktop is off by default and only reachable after the owner turns it on.

Fixed from the security review before this release (high and medium findings; the numbers are the review's, in docs/SECURITY-REVIEW-0.8.0.md):

A malicious .desktop file could leave the "no access to your files" view (#1, high): the working directory was entered before the private folders were mounted, so a relative path still reached the real session bus. The directory is now entered inside the view.
An app that couldn't be placed in its own scope still ran, unrestricted (#2, high), for unusual desktop ids or when lord-sessiond was unreachable. Desktop ids are now limited to safe characters and length, and inside a LordOS session an app that can't be placed never starts.
The microphone guard failed open (#3, high) when its client or node tables filled up or a permission list was too long. It now disconnects clients it can't follow and destroys streams it can't store.
A restricted app could record the microphone through a PulseAudio module (#4, high), which ran as the unrestricted pipewire-pulse. Module loading is off (see "Changed").
A restricted Linux app could take over an unrestricted process of the same user with ptrace (#5, high). Only descendants can be traced now (see "Changed").
Restricted Linux apps could escape through the user's own services (#13, #37, high): two attempts to exempt "the real sound server" under user@ were forgeable, because the user controls their own systemd manager. Nothing under user@ is trusted for who it claims to be any more; apps restricted from the microphone, camera, USB or Bluetooth start in their own view instead (see "Changed"), and the desktop keeps its microphone.
"Open with" could hand an app protected folders (#6, medium) such as ~/.config/autostart, firewall.json or ~/.ssh when a parent folder was opened, and a symlink swapped in between the check and the grant could redirect it (#10, medium). Writable grants never cover those folders, hard-linked files are read-only, and the grant is reopened without following symlinks and must still be the checked file.
Shared memory, terminals and caches of the session were reachable from the files view (#7, #8, medium): it now has its own /dev/shm, its own pseudo-terminals and IPC namespace, and the font, shader and GStreamer caches are read-only. More folders that other programs run code from are protected (#9), and a missing XDG_RUNTIME_DIR no longer leaves the bus reachable (#11).
A USB microphone plugged in while a no-mic app ran was open to it for a few seconds (#12, medium): every sound device not known to be playback-only is now denied in its scope.
A user process could pose as the sound server to the microphone guard (#14, #15, #16, medium) with a nested cgroup or another PID namespace. Matching is now exact (cgroup path, sole process, root-owned binary, our PID namespace).
The last frame of another user's desktop could be read after a user switch (#17, medium): lord-sessiond now removes the leaving session's framebuffers before handing the screen over.
Landlock's socket scoping failed open on older kernels (#38, medium): the files view and the device view now require Landlock ABI 6 and refuse to start the app otherwise, with a notification.
Installer and release tools (low): the verified package is reinstalled from a root-owned copy, a missing release key is an error, a validly signed older release can't downgrade an install, and the signing script refuses unexpected file names.

Known issues and limitations

Xwayland is not supported: apps that only speak X11 don't start (planned before 1.0).
Flatpak is not integrated with the Store, the launcher or the sandbox.
The Raspberry Pi 5 image has not been booted on a board yet. The build, the tests and the login screen are verified on the Pi 5 running from its own SD card, but the published image itself is still untested on hardware (docs/RASPBERRY.md).
On the Raspberry Pi 5, "No Bluetooth" is not enforced for Linux apps: the LordOS build of the Raspberry Pi kernel has no BPF LSM (CONFIG_BPF_LSM), so the Bluetooth socket program can't be loaded there (lord-netperm reports "bluetooth":false). The network rules and the other restrictions work as on a PC.
The clipboard restriction is not available for Linux apps: the Wayland data device is not mediated per app.
BlueZ over D-Bus is not mediated: a Linux app restricted from Bluetooth can't open Bluetooth sockets, but can still ask bluetoothd on the system bus to scan, pair and connect.
The .lpk signing key is still a development key. Official app packages are signed with it until the final key replaces it; a signed LordOS app repository for the Store is not built yet.
Encrypted disks (LUKS) are untested: the splash's password field has only been checked as a static preview, and Disks doesn't create LUKS or LVM volumes.
Secure Boot has to be turned off on PCs (signing with a shim is pending).
Not yet tested on real hardware: AMD and NVIDIA GPUs, laptop batteries, backlight and lid, real Bluetooth controllers, FIDO2 security keys, printers and scanners, WPA3 networks, and mail providers (OAuth is prepared but disabled).
Firewall: no "ask" mode yet (it behaves as silent); domain rules don't see apps that resolve names with their own encrypted DNS (address rules, defaults and restrictions still apply); while a restricted app runs, the systemd-run --user protection restricts the whole user manager subtree, not only the escaped process.
Wayland: drag and drop between apps, the primary selection, LordOS input methods inside Linux apps (text-input), xdg-activation and SVG app icons are pending.
Accessibility tools (screen reader, zoom, high contrast) are not available yet.
No built-in updater for LordOS itself: new versions come from GitHub Releases; Debian packages update from the Store.
Switching to a text console (Ctrl+Alt+F2) doesn't work while LordOS runs; the remote desktop has no audio yet; 802.1X/WPA-Enterprise and DHCPv6 are not supported; GRUB shows about a second of black while it loads the kernel.

See the pending items in docs/ROADMAP.md.

Upgrading

This is the first public release, so there is nothing to upgrade from. To install it:

On a PC: write lordos-live-<version>-amd64.iso to a USB stick (it is hybrid: dd, or any image writer in DD mode), boot it with Secure Boot off, try LordOS live, and open Install LordOS to install it to a disk. The whole disk is erased (docs/ISO.md).
On a Raspberry Pi 5: write lordos-<version>-rpi5-arm64.img.xz to an SD card or NVMe drive with Raspberry Pi Imager ("Use custom") (docs/RASPBERRY.md).
On an existing Debian 13 (amd64 or arm64): run curl -fsSL https://lordos.org/install.sh | sh. It asks before changing anything; --uninstall removes LordOS again (docs/INSTALL-DEBIAN.md).

Later releases: on Debian, run the installer again, or install the new .deb.

Downloads

File	What it is
`lordos-live-0.8.0-amd64.iso`	Live and installable image for 64-bit PCs (UEFI and BIOS). Write it to a USB stick as is; Secure Boot off.
`lordos-0.8.0-rpi5-arm64.img.xz`	Image for the Raspberry Pi 5, for Raspberry Pi Imager ("Use custom"), an SD card or an NVMe drive.
`lordos_0.8.0_amd64.deb`	The LordOS package for an existing Debian 13 on a PC (installed by `install.sh`, or with `apt install ./…`).
`lordos_0.8.0_arm64.deb`	The same package for Debian 13 on arm64.
`install.sh`	The one-line installer for Debian 13: `curl -fsSL https://lordos.org/install.sh \| sh`. It checks the signature before installing.
`SHA256SUMS`	The SHA-256 of every file in this release.
`SHA256SUMS.sig`	The Ed25519 signature of `SHA256SUMS` with the LordOS release key (base64).
`lordos_0.8.0_<arch>.spdx.json`	Software bill of materials (SPDX 2.3) for each package: what it bundles and the Debian packages it depends on.

Verifying the downloads

The LordOS release public key is lordos-release.pub.pem (in the repository, or at https://lordos.org/lordos-release.pub.pem). Its fingerprint, the SHA-256 of the DER public key, is:

c7155b8e6bbbb180f907381994d06af76d333016cd6f3facf67cadd053ea108e

With OpenSSL 3, in the folder with the downloads:

openssl pkey -pubin -in lordos-release.pub.pem -outform DER | sha256sum   # must match the fingerprint
base64 -d SHA256SUMS.sig > SHA256SUMS.sig.bin
openssl pkeyutl -verify -pubin -inkey lordos-release.pub.pem -rawin -in SHA256SUMS -sigfile SHA256SUMS.sig.bin
sha256sum -c --ignore-missing SHA256SUMS

"Signature Verified Successfully" and "OK" for each downloaded file mean the files are the ones we published. Details: docs/SIGNING.md.

Navigation Menu

Repository navigation

LordOS 0.8.0-beta

Choose a tag to compare

Sorry, something went wrong.